Prototype Pollution Vulnerability in devalue Package: Risks from Unevaled Code
Summary
GHSA-8qm3-746x-r74r: devalue unevaled code can create objects with polluted prototypes when evaled. Affects devalue versions < 5.6.3. Fixed in 5.6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The devalue package is a utility in the npm ecosystem that allows developers to serialize JavaScript objects into a format that can be safely evaluated later. It is designed to handle complex data structures while ensuring that the serialized output is secure. However, a vulnerability has been identified that can lead to prototype pollution when untrusted data is unevaled and subsequently evaled, potentially compromising the integrity of applications using this package.
Vulnerability Detail
The vulnerability arises from the way the devalue package handles unevaled code. When untrusted data is processed, it can generate output that, when evaled, creates objects with polluted prototypes. This means that the structure of the output data can differ significantly from the input data, leading to unexpected behavior and security risks. The vulnerability is particularly concerning because it can allow attackers to manipulate object prototypes, which can lead to denial of service or other malicious actions.
How To Fix
Minimum fixed version
5.6.3
This is the first release that contains the fix.
npm install devalue@5.6.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using unevaled data from untrusted sources. Ensure that any data being processed by the devalue package is sanitized and comes from a trusted origin. Additionally, consider implementing strict validation checks before evaling any data.
Conclusion
The devalue package has a vulnerability that can lead to prototype pollution when untrusted data is unevaled and evaled. It is crucial for developers to update to version 5.6.3 or later to mitigate this risk. Additionally, using Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for devalue →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of built-in JavaScript objects, potentially leading to unexpected behavior in applications.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your package-lock.json file, Vulert can inform you if your application is affected by this vulnerability.
Exploiting this vulnerability can lead to various issues, including denial of service, data corruption, or unauthorized access to sensitive information.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 2.1, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for devalue.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
